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Abstract of the Disclosure 


A method for classifying data involves receiving a set of 
training data from a physical process such as a computer 
network (20) . The training data has attribute data and target 
data. The target data has a class label associated with the 
attribute data. Dummy clusters are derived from centroid 
coordinates of the training data associated with the class 
label (22) . Distance measures are determined between the 
training data and a plurality of clusters which include the 
dummy clusters (24). Real clusters are created in the 
plurality of clusters if the training data is closest to a 
dummy cluster or a cluster having a class label different than 
the class label associated with the training data (26) . A 
closest match between data to be classified and the plurality 
of clusters is identified (28) and the data is classified as 
the class label of the closest match from the plurality of 
clusters (30) . 
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